name: Deploy to Production

on:
  push:
    branches: [ main ]
  workflow_dispatch:

concurrency:
  group: deploy-prod-main
  cancel-in-progress: false

jobs:
  deploy:
    name: Deploy
    runs-on: ubuntu-latest
    timeout-minutes: 20

    steps:
      - name: Checkout
        uses: actions/checkout@v3

      - name: Setup .NET
        uses: actions/setup-dotnet@v3
        with:
          dotnet-version: '10.0.x'

      - name: Build Release
        run: |
          dotnet restore src/dotnet/QuantEngine.Web/QuantEngine.Web.csproj
          dotnet build src/dotnet/QuantEngine.Web/QuantEngine.Web.csproj -c Release --no-restore

      - name: Publish
        run: dotnet publish src/dotnet/QuantEngine.Web/QuantEngine.Web.csproj -c Release -o ./publish

      - name: Package
        run: |
          COMMIT=$(git rev-parse --short HEAD)
          tar -czf quantengine-${COMMIT}.tar.gz -C ./publish .
          echo "ARTIFACT=quantengine-${COMMIT}.tar.gz" >> $GITHUB_ENV

      - name: Upload Artifact
        uses: actions/upload-artifact@v3
        with:
          name: quantengine-${{ github.run_number }}
          path: quantengine-*.tar.gz
          retention-days: 7

      - name: Verify Secrets
        run: |
          if [ -z "${{ secrets.QUANTENGINE_DB_PASSWORD }}" ]; then
            echo "ERROR: DB password not configured"
            exit 1
          fi
          echo "OK: Secrets verified"

      - name: Deploy to Production
        run: |
          echo "Deployment triggered: ${{ github.run_number }}"
          echo "Commit: $(git rev-parse --short HEAD)"
          echo "Artifact: ${{ env.ARTIFACT }}"